Integration with OnePass on Windows (CUHK Login via ADFS)

Integration with OnePass on Windows (CUHK Login via ADFS)

Information included on this page will help you to install and use Shibboleth for authentication and integration with OnePass on an Linux or Windows or other servers.

 

1. Requirements
  • Service Provider using Windows version below
    – Windows Server 2008 R2, or above
  • IIS is being started with SSL enabled
  • Signing algorithm should be SHA256 for the federation
  • The application server time must be kept up-to-date and accurate
  • Logout button should be enhanced for global sign out OnePass session

 

2. Shibboleth Installation

For IIS6/IIS7 and Shibboleth SP 2.6

  • Download Shibboleth SP 2.6 .msi Shibboleth SP installer (for 64-bit machine)
  • Run the installer, accepting the default settings, the shibd service will also be installed for you
  • Reboot your server after installation completed
  • Verify Shibboleth installation with
    • In Services, the Shibboleth service should have Service = Running, Startup Type = Automatic and Logon As = Local System
    • Open IIS Manager, click the server name and open ISAPI Filters. The settings should be
      Name = Shibboleth and
      Executable = C:\opt\shibboleth-sp\lib64\shibboleth\isapi-shib.dll
    • In IIS Manager, click the server name and open Handler Mappings. The setting should be
      Path = *.sso,
      State = Enabled,
      Path Type = Unspecified,
      Handler = IsapiModule, and
      Entry Type = Inherited
    • In IIS Manager, click the website name under Sites, then open Handler Mappings. The settings should be
      Path = *.sso,
      State = Enabled,
      Path Type = Unspecified,
      Handler = IsapiModule, and
      Entry Type = Inherited
    • Open a web browser, go to https://localhost/Shibboleth.sso/Status (case sensitive), it should return an XML document with:
      <Status><OK/></Status>

 

For IIS7 or above and Shibboleth SP 3.0

  • Prerequisites
    A default installation of IIS is enough but “ISAPI Extensions” & “ISAPI Filters” have to be installed
  • Download the latest .msi Shibboleth SP installer (The 32-bit web server modules can function with a 64-bit shibd service, so there is no need to install a 32-bit shibd to handle 32-bit app pools)
  • Run the installer, accepting the default settings and “Configure IIS7 module” must be checked, the shibd service will also be installed for you
  • Reboot your server after installation completed
  • Verify Shibboleth installation with
    • In Services, the Shibboleth service should have Service = Running, Startup Type = Automatic and Logon As = Local System
    • Check C:\Windows\System32\InetSrv\config\applicationHost.config, IIS7 Shibboleth modules should be added as below
    • Open a web browser, go to https://localhost/Shibboleth.sso/Status (case sensitive), it should return an XML document with:
      <Status><OK/></Status>
3. Basic Configuration of Shibboleth (/etc/shibboleth/shibboleth2.xml)
  • Default configuration files should be found in C:\opt\shibboleth-sp\etc\shibboleth\
  • In C:\opt\shibboleth-sp\etc\shibboleth\, update below information on shibboleth2.xml

– Site id, In the ISAPI element, verify the Site id=”1″. Clicking Sites in IIS will reveal the ID assigned to this site
– name, update the name “sp.example.org” to your website hostname
– RequestMap, update Hostname from “sp.example.org” to your website hostname
– Path name, update Path tags to create a path to the parts of the service that will be Shibboleth-enabled
– ApplicationDefaults, update entityID=”sp.example.org” to the hostname, e.g. https://abc.cuhk.edu.hk/shibboleth, change REMOTE_USER=”NameID”, addsigningAlg=”http://www.w3.org/2001/04/xmldsig-more#rsa-sha256″ digestAlg=”SHA256″
– Sessions lifetime: update to “28800”, timeout: update to “1200”
– SSO entityID, should be updated to OnePass entityID, the entityIDs for testing / UAT / production environments:
Testing: http://ststest.itsc.cuhk.edu.hk/adfs/services/trust
UAT: http://stsu.itsc.cuhk.edu.hk/adfs/services/trust
Production: http://sts.cuhk.edu.hk/adfs/services/trust
– Handle type: update to “MetadataGenerator”, signing: update to “true”
– Errors supportContact: update to a valid email address for the person managing the SP configuration
 – MetadataProvider type: update the uri to OnePass testing / UAT / Production environments
Testing: https://ststest.itsc.cuhk.edu.hk/federationmetadata/2007-06/federationmetadata.xml
UAT: https://stsu.itsc.cuhk.edu.hk/federationmetadata/2007-06/federationmetadata.xml
Production: https://sts.cuhk.edu.hk/federationmetadata/2007-06/federationmetadata.xml

  • Install an X509 certificate
    – Use the keygen.bat command in C:\opt\shibboleth-sp\etc\shibboleth to create new certificate
    – keygen.bat –h {your hostname} –e {IDP entityID} –y {number of years to issue}
    e.g. keygen.bat –h abc.cuhk.edu.hk –e http://ststest.itsc.cuhk.edu.hk/adfs/services/trust –y 10 (Testing)
    keygen.bat –h abc.cuhk.edu.hk –e http://sts.cuhk.edu.hk/adfs/services/trust –y 10 (Production)
  • Restart shibboleth service after configuration, and check any error at C:\opt\shibboleth-sp\var\log\shibboleth\
  • Sample shibboleth2.xml for Windows host and OnePass testing environment

 

4. Modification for Attributes Mapping (C:\opt\shibboleth-sp\etc\shibboleth\attribute-map.xml)
  • Core Attributes (The attributes are released by default)

AttributeID Reference for Attributes Mapping
NameID <Attribute name=”urn:oasis:names:tc:SAML:2.0:nameid-format:persistent” id=”NameID”/>
objectGUID <Attribute name=”urn:oid:1.2.840.113556.1.4.2″ id=”objectGUID”/>
eduPersonAffiliation <Attribute name=”urn:oid:1.3.6.1.4.1.5923.1.1.1.1″ id=”unscoped-affiliation”>
<AttributeDecoder xsi:type=”StringAttributeDecoder” caseSensitive=”false”/>
</Attribute>
displayName <Attribute name=”urn:oid:2.16.840.1.113730.3.1.241″ id=”displayName”/>

  • Additional attributes (upon request)

AttributeID SAML 2 Names
employeeNumber <Attribute name=”urn:oid:2.16.840.1.113730.3.1.3″ id=”employeeNumber”/>
surname <Attribute name=”urn:oid:2.5.4.4″ id=”sn”/>
givenName <Attribute name=”urn:oid:2.5.4.42″ id=”givenName”/>

Restart shibboleth service after configuration, and check any error at C:\opt\shibboleth-sp\var\log\shibboleth\

 

5. Integration Work with OnePass Team

 

6. Simple Test
  • Remember to clean up your browser cache first, it’ll be good to use incognito or InPrivate mode for testing
  • Assume ASP.Net is enabled in your server
  • By default, your server’s path /secure is protected by OnePass. If you want to change it, please refer to
    C:\opt\shibboleth-sp\etc\shibboleth\shibboleth2.xml and update the “Path name”
    Create a test.aspx in your /secure/test.aspx to print all variables:
    <% For Each var as String in Request.ServerVariables
    Response.Write(var & ” ” & Request(var) & “<p>”) Next %>
  • Open a browser to access https://{yourhostname}/secure/test.php
  • You will be redirected to OnePass login page, key in valid Login ID and password
  • You should be able to authenticate and find your Login ID in server variable HTTP_NameID and and REMOTE_USER
    e.g. for getting attribute variable: HTTP_{attr}, e.g. HTTP_giveName
  • Logout, you will be redirected to OnePass Logout page. Access your website again and see if you have to fill in your credential to login OnePass